Platform Security & Responsible Disclosure
Last updated: August 30, 2026 • Security Architecture & Researcher Guidelines
At Shittal's Institute of Fashion (SIF), the integrity of our students' personal data, proprietary video masterclasses, and certified diploma credentials is of paramount importance.
1. Multi-Layered Security Architecture
Real-time Firestore snapshot listeners monitor unique active session identifiers, automatically logging out concurrent logins across devices to prevent unauthorized credential sharing.
All financial transactions are handled via RBI-compliant Razorpay gateways with server-side price verification and HMAC signature validation. SIF never stores credit card details.
Video lessons incorporate randomized, dynamic visual watermarks displaying the authenticated student's email and UID to deter video capture and intellectual property theft.
Every issued diploma generates a unique immutable cryptographic hash linked to our public credential verification registry (`/verify-certificate/[id]`).
2. Responsible Vulnerability Disclosure Program
We welcome reports from independent security researchers, ethical hackers, and students who identify potential vulnerabilities in our web applications, APIs, or infrastructure.
Guidelines for Ethical Researchers:
- Provide sufficient detail and reproducible steps (PoC) in your report.
- Do not access, modify, or delete data belonging to other students or instructors.
- Do not perform Denial of Service (DoS/DDoS) attacks or spam automated requests against our SMTP/API endpoints.
- Allow our engineering team a reasonable 48–72 hour disclosure window to remediate the vulnerability before public disclosure.
How to Submit a Security Report
Please submit vulnerability details directly to our security response desk:
To: support@siflegacy.com
Subject: [Security Vulnerability Report] - Brief Description
Response Time: Acknowledgment within 24 business hours